3 ms·
> 4. Using a keyfile is optional and IMO don't see how it adds any security benefits to the master passphrase. I believe it fulfills the same 2FA role as does
by mdaniel 3y ago
> 4. Using a keyfile is optional and IMO don't see how it adds any security benefits to the master passphrase.
I believe it fulfills the same 2FA role as does the Secret Key in 1Password <https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/>: combining something you know (passphrase) with something you have (keyfile/Secret Key), thus making a potential Dropbox breach (or wherever you store your .kdbx) not subject to offline dictionary attacks -- err, unless you also stored your keyfile in Dropbox in which case, yes, it wouldn't add any security benefits
- Timber-6539 3y agoA strong passphrase should be good enough to deter dictionary attacks, even if your kdbx file is leaked. And even then the ciphers used to encrypt the kdbx file are highly configurable, you can future-proof the key derivation function as much as your hardware can reasonably afford to unlock the file. Besides using a keyfile for daily use is impractical. For correct usage, you'd have to keep it in a separate drive from your kdbx (in a USB flash perhaps), as you very well mentioned. But then in the menu you'd have to go to the directory the keyfile is stored in every single time you want to unlock your database if am not mistaken about how the feature works on KeepassXC.